2021-05-12 14:32:11
Linux iptables 埠轉發
2020-06-16 17:11:19
準備：
1， UDP埠範圍對映
2， tcp 埠範圍對映
3， 本機埠轉發
4， 單個埠轉發
準備：
開啟轉發
[root@CentOS ~]# cat /etc/sysctl.conf | grep net.ipv4.ip_forward
net.ipv4.ip_forward = 1
清空規則，修改預設策略，重要資料請備份
[root@CentOS ~]# iptables -F -t nat
[root@CentOS ~]# iptables -X -t nat
[root@CentOS ~]# iptables -P INPUT DROP
[root@CentOS ~]# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@CentOS ~]#
刪除reject
[root@CentOS ~]# vim /etc/sysconfig/iptables
[root@CentOS ~]# service iptables restart
1， UDP埠範圍對映
一一匹配：
[root@CentOS ~]# iptables -t nat -A PREROUTING -p udp --dport 5000:6000 -j DNAT --to 192.168.66.2:5000-6000
【注意】這樣寫，將導致不可預測的埠轉發匹配：
[root@CentOS ~]# iptables -t nat -A PREROUTING -p udp --dport 5000:5010 -j DNAT --to 192.168.66.2:6000-6010
【nat內機器：192.168.66.2】埠轉發匹配驗證，輸出源埠是9999
[root@CentOS ~]# tcpdump -i eth0 -tnn port 9999
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
IP 172.16.20.245.9999 > 192.168.66.2.5500: UDP, length 1
IP 172.16.20.245.9999 > 192.168.66.2.5500: UDP, length 1
IP 172.16.20.245.9999 > 192.168.66.2.5501: UDP, length 1
IP 172.16.20.245.9999 > 192.168.66.2.5501: UDP, length 1
【nat外機器：172.16.20.245】傳送給nat機器，發出的封包源埠是9999， 目的埠是5500-5555
sudo nc -v -u -p 9999 172.16.20.183 5500-5555
埠轉發雙向通訊驗證：
nat裡面的機器開啟監聽：
[root@CentOS ~]# nc -l -u 5555
nat外面的機器向nat 傳送資料
nc -u 172.16.20.183 5555
互發資料，雙方是可以收到的。
可以發現：埠對映完全匹配，雙通互發資料成功！
2， tcp 埠範圍對映
tcp 埠範圍對映：
[root@CentOS ~]# iptables -t nat -A PREROUTING -p tcp --dport 2000:2500 -j DNAT --to 192.168.66.2:2000-2500
驗證：
接收端：【nat內機器：192.168.66.2】
[root@CentOS ~]# tcpdump -i eth0 -tnn portrange 2000-2500
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
IP 172.16.20.245.37446 > 192.168.66.2.2000: Flags [S], seq 1083771445, win 29200, options [mss 1460,sackOK,TS val 3864340 ecr 0,nop,wscale 7], length 0
IP 192.168.66.2.2000 > 172.16.20.245.37446: Flags [R.], seq 0, ack 1083771446, win 0, length 0
IP 172.16.20.245.47912 > 192.168.66.2.2001: Flags [S], seq 629593170, win 29200, options [mss 1460,sackOK,TS val 3864344 ecr 0,nop,wscale 7], length 0
IP 192.168.66.2.2001 > 172.16.20.245.47912: Flags [R.], seq 0, ack 629593171, win 0, length 0
IP 172.16.20.245.34816 > 192.168.66.2.2002: Flags [S], seq 680276410, win 29200, options [mss 1460,sackOK,TS val 3864345 ecr 0,nop,wscale 7], length 0
IP 192.168.66.2.2002 > 172.16.20.245.34816: Flags [R.], seq 0, ack 680276411, win 0, length 0
IP 172.16.20.245.37508 > 192.168.66.2.2003: Flags [S], seq 1070666075, win 29200, options [mss 1460,sackOK,TS val 3864345 ecr 0,nop,wscale 7], length 0
IP 192.168.66.2.2003 > 172.16.20.245.37508: Flags [R.], seq 0, ack 1070666076, win 0, length 0
傳送端：【nat外機器：172.16.20.245】傳送給nat機器:
sudo nc -z -w1 -v 172.16.20.183 2000-2500
nc: connect to 172.16.20.183 port 2000 (tcp) failed: Connection refused
nc: connect to 172.16.20.183 port 2001 (tcp) failed: Connection refused
nc: connect to 172.16.20.183 port 2002 (tcp) failed: Connection refused
nc: connect to 172.16.20.183 port 2003 (tcp) failed: Connection refused
nc: connect to 172.16.20.183 port 2004 (tcp) failed: Connection refused
nc: connect to 172.16.20.183 port 2005 (tcp) failed: Connection refused
nc: connect to 172.16.20.183 port 2006 (tcp) failed: Connection refused
nc: connect to 172.16.20.183 port 2007 (tcp) failed: Connection refused
可以看見，雖然連線失敗，但是傳送的seq和ack回應包都有了，就差握手成功了。
3， 本機埠轉發
[root@CentOS ~]# iptables -t nat -A PREROUTING -p tcp --dport 1234 -j REDIRECT --to-ports 2345
[root@CentOS ~]# nc -l -k 2345 #開啟監聽
1，
區域網其他主機直接來存取本機2345埠：看看tcpdump輸出
linuxidc@Ubuntu~$ nc 172.16.20.183 2345 #遠端機存取本機172.16.20.183 2345
本機tcpdump輸出
[root@CentOS ~]# tcpdump -i eth0 host 172.16.20.245 -tnn
IP 172.16.20.245.44706 > 172.16.20.183.2345: Flags [S], seq 33366406, win 29200, options [mss 1460,sackOK,TS val 4001328 ecr 0,nop,wscale 7], length 0
IP 172.16.20.183.2345 > 172.16.20.245.44706: Flags [R.], seq 0, ack 33366407, win 0, length 0
2，區域網其他主機直接來存取本機1234埠：看看tcpdump輸出
linuxidc@ubuntu~$ nc 172.16.20.183 1234 #遠端機存取本機172.16.20.183 1234
tcpdump在本機看一下：
[root@CentOS ~]# tcpdump -i eth0 host 172.16.20.245 -tnn
IP 172.16.20.245.47332 > 172.16.20.183.1234: Flags [S], seq 3622624416, win 29200, options [mss 1460,sackOK,TS val 4047126 ecr 0,nop,wscale 7], length 0
IP 172.16.20.183.1234 > 172.16.20.245.47332: Flags [S.], seq 123535638, ack 3622624417, win 14480, options [mss 1460,sackOK,TS val 12018501 ecr 4047126,nop,wscale 6], length 0
IP 172.16.20.245.47332 > 172.16.20.183.1234: Flags [.], ack 1, win 229, options [nop,nop,TS val 4047126 ecr 12018501], length 0
IP 172.16.20.245.47332 > 172.16.20.183.1234: Flags [P.], seq 1:2, ack 1, win 229, options [nop,nop,TS val 4047282 ecr 12018501], length 1
IP 172.16.20.183.1234 > 172.16.20.245.47332: Flags [.], ack 2, win 227, options [nop,nop,TS val 12019122 ecr 4047282], length 0
IP 172.16.20.245.47332 > 172.16.20.183.1234: Flags [P.], seq 2:3, ack 1, win 229, options [nop,nop,TS val 4047325 ecr 12019122], length 1
IP 172.16.20.183.1234 > 172.16.20.245.47332: Flags [.], ack 3, win 227, options [nop,nop,TS val 12019297 ecr 4047325], length 0
IP 172.16.20.245.47332 > 172.16.20.183.1234: Flags [P.], seq 3:4, ack 1, win 229, options [nop,nop,TS val 4047353 ecr 12019297], length 1
可以看到三次握手成功！
4， 單個埠轉發
埠轉發 tcp模式：將存取本機1122埠封包轉發給192.168.66.2:5566
iptables -t nat -A PREROUTING -p tcp --dport 1122 -j DNAT --to-destination 192.168.66.2:5566
埠轉發 udp模式：將存取本機2233埠封包轉發給192.168.66.2:4455
iptables -t nat -A PREROUTING -p udp --dport 2233 -j DNAT --to-destination 192.168.66.2:4455
更多iptables相關教學見以下內容：
CentOS 7.0關閉預設防火牆啟用iptables防火牆 http://www.linuxidc.com/Linux/2015-05/117473.htm
Iptables工作原理使用詳解 http://www.linuxidc.com/Linux/2016-09/134945.htm
Ubuntu 14.04 設定iptables防火牆 http://www.linuxidc.com/Linux/2017-02/140556.htm
Linux下編譯安裝iptables http://www.linuxidc.com/Linux/2017-04/142615.htm
iptables的備份、恢復及防火牆指令碼的基本使用 http://www.linuxidc.com/Linux/2013-08/88535.htm
Iptables工作原理使用詳解 http://www.linuxidc.com/Linux/2016-09/134945.htm
CentOS7下iptables設定過程 http://www.linuxidc.com/Linux/2017-01/139622.htm
Linux下iptables防火牆設定 http://www.linuxidc.com/Linux/2015-10/123843.htm
Linux防火牆iptables詳解 http://www.linuxidc.com/Linux/2016-12/138474.htm
本文永久更新連結地址：http://www.linuxidc.com/Linux/2017-07/145378.htm
相關文章